System operations management apparatus, system operations management method and program storage medium

ABSTRACT

In a system operations management apparatus, a burden to a system administrator when providing a decision criterion in detection of a failure in the future is reduced. The system operations management apparatus  1  includes a performance information accumulation unit  12 , a model generation unit  30  and an analysis unit  31 . The performance information accumulation unit  12  stores performance information including a plurality of types of performance values in a system in time series. The model generation unit  30  generates a correlation model including one or more correlations between the different types of performance values stored in the performance information accumulation unit  12  for each of a plurality of periods having one of a plurality of attributes. The analysis unit  31  performs abnormality detection of the performance information of the system which has been inputted by using the inputted performance information and the correlation model corresponding to the attribute of a period in which the inputted performance information has been acquired.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation application of U.S. patentapplication Ser. No. 13/133,718 filed on Jun. 9, 2011, which is aNational Stage Entry of International Application PCT/JP2010/068527,filed on Oct. 13, 2010, which claims the benefit of priority fromJapanese Patent Application 2009-238747 filed on Oct. 15, 2009, thedisclosures of all of which are incorporated in their entirety byreference herein.

TECHNICAL FIELD

The present invention relates to a system operations managementapparatus, a system operations management method and a program storagemedium, and, more particularly, to a system operations managementapparatus, a system operations management method and a program storagemedium which determine a system operating status of a managed system.

BACKGROUND ART

In offering services targeting customers, in recent years, there exist alot of services using a computer system and information andcommunication technology such as mail-order selling using the internet.In order to carry out such services smoothly, it is requested that thecomputer system always operates stably. Therefore, operations managementof the computer system is indispensable.

However, operations management of such system has been performedmanually by a system administrator. Therefore, there is a problem that,along with increase in scale and complexity of the system, sophisticatedknowledge and experience are required for the system administrator, andthe system administrator or the like who does not have such knowledgeand experience sufficiently may cause wrong operations.

In order to avoid such problem, a system operations management apparatuswhich performs unified monitoring of a status of the hardware thatcomposes a system and controlling thereof has been provided. This systemoperations management apparatus acquires data representing an operatingstatus of the hardware of the managed system (hereinafter, referred toas performance information) online, and determines presence of a failureon the managed system from a result of analysis of the performanceinformation and shows its content to a display unit (for example, amonitor) which is an element included in the system operationsmanagement apparatus. Here, as an example of a method to determinepresence of the failure mentioned above, there are a technique toperform determination based on a threshold value for the performanceinformation in advance and a technique to perform determination based ona reference range for a difference between an actual measurement valueof the performance information and a calculated value (theoreticalvalue) of the performance information calculated in advance.

In this system operations management apparatus, information aboutpresence or absence of the failure on the system is shown on the displayunit such as the monitor as mentioned above. Therefore, when presence ofthe failure is shown, the cause of the failure needs to be narrowed downfrom the shown content to whether the cause of the failure is lack ofthe memory capacity or whether it is overload of a CPU (CentralProcessing Unit) in order to improve the failure. However, because suchnarrowing-down work of the cause of the failure requires aninvestigation of system histories and parameters of portions which seemto be related to occurrence of the failure, the work needs to depend onthe experience and sense of the system administrator who performs thework. Therefore, a high skill will be required inevitably for the systemadministrator who operates the system operations management apparatus.At the same time, solving the system failure through operation of thesystem operations management system forces the system administrator tobear heavy time and physical burden.

Accordingly, in this system operations management apparatus, it isimportant to perform analysis of a combination of abnormal statuses orthe like automatically based on information of processing capacitiescollected from the managed system, inform the system administrator of asummarized point of a problem and a cause of the failure which areestimated roughly, and then receive an instruction for handling thereof.

Thus, there are various related technologies regarding the systemoperations management apparatus equipped with functions to reduce theburden of the system administrator who performs management of the systemand repair work of the failure. Hereinafter, those related technologieswill be described.

The technology disclosed in Japanese Patent Application Laid-Open No.2004-062741 is a technology related to a failure information displayapparatus which indicates failure information of a system. Thistechnology makes it possible to recognize the location of a failurevisually and easily, simplifies estimation of the origin of the failure,and thus reduces a burden of a system administrator, by showing afailure message according to the order of occurrence of the failure andactual arrangement of a faulty unit to outside, when any failure isfound in management of an operating status of the managed dataprocessing system.

The technology disclosed in Japanese Patent Application Laid-Open No.2005-257416 is a technology related to an apparatus which diagnoses ameasured device based on time series information on parameters acquiredfrom the measured device. The technology detects a failure caused byperformance deterioration of the measured device appropriately bycalculating strength of a correlation between information of parametersbased on variations of time series information of the parameters.According to this technology, it can be judged appropriately whethertime series variations of information on different parameters aresimilar or not.

The technology disclosed in Japanese Patent Application Laid-Open No.2006-024017 is a technology related to a system for estimating thecapacity of a computer resource. The technology identifies an amount ofa load caused by specific processing and analyzes the load associatedwith an amount of processing in the future by comparing a history ofprocessing of system elements and a history of changes in performanceinformation. According to this technology, when relation between theprocessing and the load has been grasped in advance, the behavior of asystem can be identified.

Technology disclosed in Japanese Patent Application Laid-Open No.2006-146668 is a technology related to an operations management supportapparatus. This technology acquires information on an operating statusof hardware such as a CPU and information on access volume to a webcontrol server from a managed system in a regular time interval, finds acorrelation between a plurality of elements which compose theinformation, and determines whether the current status of the system isnormal or not from the correlation. According to this technology, asituation of performance degradation of the system can be detected moreflexibly while the cause of the degradation and measures thereto can beshown in detail.

The technology disclosed in Japanese Patent Application Laid-Open No.2007-293393 is a technology related to a fault monitoring system whichsearches similar failures in the past. By acquiring information relatedto various kinds of processing capacity periodically and indicating theinformation on a time axis along with information related to a failurewhich occurred in the past, the technology can predict occurrence of afailure in the future based on whether it is similar to analysisinformation at the time of occurrence of the failure in the past.

The technology disclosed in Japanese Patent Application Laid-Open No.H10-074188 is a technology related to a data learning device. Thetechnology compares information of a learning object acquired from adata managed apparatus and information related to an estimated valuegenerated in advance, and determines that the acquired information isexceptional information when the similarity degree between them issmaller than or equal to a predetermined criterion. Further, thetechnology corrects the content of the information related to theestimated value based on a difference between them. According to thistechnology, processing accuracy of data managed apparatus can beimproved by repeating such operation.

SUMMARY OF INVENTION Technical Problem

However, in the technologies disclosed in each of the above patentdocuments, there have been problems which will be mentioned below.

First, in the technology disclosed in Japanese Patent ApplicationLaid-Open No. 2004-062741, although handling of the system failure whichhas occurred actually is performed accurately and easily, there is aproblem that the system failure which may happen in the future is notprevented. Therefore, there is a problem that the prevention of thesystem failure in the future still remains as work with a heavy burdenfor the system administrator having less experience.

Next, in the technology disclosed in Japanese Patent ApplicationLaid-Open No. 2005-257416, the structure and the behavior of the targetsystem need to be understood correctly in advance in order to identifythe failure which has occurred actually from the number and the contentof the correlations which have collapsed. That is, it is necessary tofigure out in advance that what kind of the correlation collapse causeswhat kind of the failure. For this reason, there is a problem that asystem administrator is required to have great experience and knowledgeand is forced a heavy burden when this technology is implemented.

Next, in the technology disclosed in Japanese Patent ApplicationLaid-Open No. 2006-024017, when a system of a prediction object is largein scale, or it has a structure to cooperate with other systems, therelation between processing and a load becomes very complicated, so thatthe history of all processing which can be related has to be collectedand analyzed in order to estimate the amount of the load correctly.

In order to perform a correct prediction in such analysis, a load of thedata collection and the analysis is large, thus there is a problem thata person who is involved in the analysis is forced a heavy burden. Also,there is a problem that the person who is involved in the analysis needsto have a very high level of knowledge.

Next, in the technology disclosed in Japanese Patent ApplicationLaid-Open No. 2006-146668, although clarification of the cause of and animprovement action to a system abnormality which has occurred actuallyare performed in a appropriate manner, a system administrator or thelike has to perform prediction of occurrence of the system abnormalityin the future by himself based on a determination result of normality ofthe current status of the system. Therefore, there is a problem that thesystem administrator is required to have great experience and is forceda heavy burden.

Next, in the technology disclosed in Japanese Patent ApplicationLaid-Open No. 2007-293393, when the content of information on ananalysis object is information which continues in time series withoutdistinction between normal and abnormality, it cannot be figured outclearly only from its values and changing status that which part is thefailure. Therefore, in such case, there is a problem that a systemadministrator or the like has to detect a faulty part based on his ownexperience and thus the system administrator is forced a heavy burden.

Next, in the technology disclosed in Japanese Patent ApplicationLaid-Open No. H10-074188, the system administrator himself needs tocreate the information concerning the estimated value mentioned above.Because great experience is required for such creation, there is aproblem that the system administrator is forced a heavy burden.

As stated above, in each of the conventional related technologies, skilland experience beyond a certain level is required for a systemadministrator, and also a burden forced to the system administrator orthe like is heavy.

Further, because there is a tendency of increase in the level andcomplexity of the content of a managed system in these days, it isexpected that a burden which a system administrator is forced will alsoincrease further in the future.

Object of Invention

The object of the present invention is to provide a system operationsmanagement apparatus, a system operations management method and aprogram storage medium which solve the above-mentioned problems and canreduce a burden to a system administrator when providing a decisioncriterion in detection of a fault in the future.

Solution to Problem

A system operations management apparatus according to an exemplaryaspect of the invention includes a performance information accumulationmeans for storing performance information including a plurality of typesof performance values in a system in time series, a model generationmeans for generating a correlation model which includes one or morecorrelations between different ones of said types of performance valuesstored in said performance information accumulation means for each of aplurality of periods that has one of a plurality of attributes, and ananalysis means for performing abnormality detection of said performanceinformation of said system which has been inputted by using saidinputted performance information and said correlation modelcorresponding to said attribute of a period in which said inputtedperformance information has been acquired.

A system operations management method according to an exemplary aspectof the invention includes storing performance information including aplurality of types of a performance values in a system in time series,generating a correlation model which includes one or more correlationsbetween different ones of said plurality of types of performance valuesfor each of a plurality of periods that has one of a plurality ofattributes, and performing abnormality detection of said performanceinformation of said system which has been inputted by using saidinputted performance information and said correlation modelcorresponding to said attribute of a period in which said inputtedperformance information has been acquired.

A program recording medium recording thereon a system operationsmanagement program, causing computer to perform a method, according toan exemplary aspect of the invention includes storing performanceinformation including a plurality of types of a performance values in asystem in time series, generating a correlation model which includes oneor more correlations between different ones of said plurality of typesof performance values for each of a plurality of periods that has one ofa plurality of attributes, and performing abnormality detection of saidperformance information of said system which has been inputted by usingsaid inputted performance information and said correlation modelcorresponding to said attribute of a period in which said inputtedperformance information has been acquired.

Advantageous Effects of Invention

The effect of the present invention is to reduce a burden to a systemadministrator substantially when providing a criterion in detection of afault in the future in a system operations management apparatus.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 A block diagram showing a structure of a first exemplaryembodiment of a system operations management apparatus of the presentinvention.

FIG. 2 An explanatory drawing showing an example of schedule informationin the first exemplary embodiment of the present invention.

FIG. 3 An explanatory drawing showing another example of scheduleinformation in the first exemplary embodiment of the present invention.

FIG. 4 An explanatory drawing showing yet another example of scheduleinformation in the first exemplary embodiment of the present invention.

FIG. 5 An explanatory drawing showing an example of an operation forgenerating a correlation change analysis result in the first exemplaryembodiment of the present invention.

FIG. 6 A flow chart showing an operation of a system operationsmanagement apparatus in the first exemplary embodiment of the presentinvention.

FIG. 7 A block diagram showing a structure of a second exemplaryembodiment of a system operations management apparatus of the presentinvention.

FIG. 8 A block diagram showing a structure of a candidate informationgeneration unit 21 in the second exemplary embodiment of the presentinvention.

FIG. 9 An explanatory drawing showing an example of an operation forgenerating schedule candidate information in the second exemplaryembodiment of the present invention.

FIG. 10 An explanatory drawing showing an example of an operation forgenerating a correlation change analysis result in the second exemplaryembodiment of the present invention.

FIG. 11 A block diagram showing a structure of a correction candidategeneration unit 22 in the second exemplary embodiment of the presentinvention.

FIG. 12 An explanatory drawing showing an example of a generationprocedure of a correction candidate of an analysis schedule in thesecond exemplary embodiment of the present invention.

FIG. 13 An explanatory drawing showing an example of a generationprocedure of a correction candidate of an analysis schedule in thesecond exemplary embodiment of the present invention (continuation ofFIG. 12).

FIG. 14 An explanatory drawing showing an example of content displayedby an administrator dialogue unit 14 in the second exemplary embodimentof the present invention.

FIG. 15 A flow chart showing an operation for generating schedulecandidate information in the second exemplary embodiment of the presentinvention.

FIG. 16 A flow chart showing an operation for generating a correctioncandidate of schedule information in the second exemplary embodiment ofthe present invention.

FIG. 17 A block diagram showing a structure of a third exemplaryembodiment of a system operations management apparatus of the presentinvention.

FIG. 18 An explanatory drawing showing an example of content displayedby the administrator dialogue unit 14 in the third exemplary embodimentof the present invention.

FIG. 19 A flow chart showing an operation by a conforming modeldetermination unit 23 in the third exemplary embodiment of the presentinvention.

FIG. 20 A block diagram showing a structure which is the premise of asystem operations management apparatus according to the presentinvention.

FIG. 21 An explanatory drawing showing an example of performanceinformation of the system operations management apparatus shown in FIG.20.

FIG. 22 An explanatory drawing showing an example of a status that theperformance information shown in FIG. 21 has been stored in a mannerbeing accumulated.

FIG. 23 An explanatory drawing showing an example of a correlation modelof the system operations management apparatus shown in FIG. 20.

FIG. 24 A flow chart showing an operation of the system operationsmanagement apparatus shown in FIG. 20.

FIG. 25 An explanatory drawing showing an example of content displayedon the administrator dialogue unit 14 of the system operationsmanagement apparatus shown in FIG. 20.

FIG. 26 A block diagram showing a characteristic structure of the firstembodiment of the present invention.

DESCRIPTION OF EMBODIMENTS

Hereinafter, each exemplary embodiment of a system operations managementapparatus according to the present invention will be described based onFIGS. 1 to 26.

[System Operations Management Apparatus which is the Premise of thePresent Invention]

First, a system operations management apparatus 101 which is the premiseof the present invention will be described based on FIGS. 20 to 25before the description of a first exemplary embodiment.

FIG. 20 is a block diagram showing a structure which is the premise ofthe system operations management apparatus according to the presentinvention.

In FIG. 20, the system operations management apparatus 101 manages anoperating status of a service-for-customers execution system 4. Theservice-for-customers execution system 4 receives information E which isrequested by a customer through an electric telecommunication line andcarries out a service of providing the above-mentioned information tothe customer.

The service-for-customers execution system 4 includes one or moreservers. The service-for-customers execution system 4 is configured as acomputer which is independent from the system operations managementapparatus 101.

As shown in FIG. 20, the system operations management apparatus 101includes a performance information collection unit 11 and a performanceinformation accumulation unit 12. Here, the performance informationcollection unit 11 acquires performance information of a server includedin the service-for-customers execution system 4 periodically from theserver. The performance information accumulation unit 12 storesperformance information acquired by the performance informationcollection unit 11 sequentially. As a result, the performanceinformation of the server included in the service-for-customersexecution system 4 can be stored with time.

Here, the performance information of the server is information includinga plurality types of performance values obtained by quantifying a statusof each of various elements (a CPU and a memory, for example) which haveinfluence on the operation of the server that is included in theservice-for-customers execution system 4. As specific examples of theperformance value, there are a CPU utilization rate and a remainingmemory capacity.

FIG. 21 is an explanatory drawing showing an example of the performanceinformation of the system operations management apparatus shown in FIG.20. FIG. 22 is an explanatory drawing showing an example of a statusthat the performance information shown in FIG. 21 has been stored in amanner being accumulated.

For example, the performance information collection unit 11 acquires theperformance information such as FIG. 21, and the performance informationaccumulation unit 12 stores the performance information as shown in FIG.22.

As shown in FIG. 20, the system operations management apparatus 101includes a correlation model generation unit 16, an analytical modelaccumulation unit 17 and a correlation change analysis unit 18. Thecorrelation model generation unit 16 generates a correlation model ofthe operating status of the service-for-customers execution system 4.The analytical model accumulation unit 17 stores the correlation modelgenerated by the correlation model generation unit 16. The correlationchange analysis unit 18 determines whether the difference between anactual measurement value of the performance value included in theperformance information and a value calculated by a transform functionof the correlation model stored in the analytical model accumulationunit 17 is within a reference range set in advance or not and outputsthe result of the determination. By this, the operating status of theservice-for-customers execution system 4 can be checked. Here, thecorrelation model generation unit 16 generates the correlation model bytaking out time-series data of the performance information for apredetermined period stored in the performance information accumulationunit 12, and deriving the transform function between any two types ofthe performance values of the performance information based on thistime-series data.

Moreover, as shown in FIG. 20, the system operations managementapparatus 101 includes a failure analysis unit 13, an administratordialogue unit 14 and a handling executing unit 15. The failure analysisunit 13 analyzes presence or absence of a possibility of a systemfailure for the service-for-customers execution system 4 based on aresult of analysis of the performance information by the correlationchange analysis unit 18. When the failure analysis unit 13 determinesthat there is a possibility of a system failure, the administratordialogue unit 14 indicates the determination result to outside, and,when an improvement order for the system failure is inputted fromoutside in response to the indicated content, the administrator dialogueunit 14 accepts the inputted information. When the improvement order isinputted to the administrator dialogue unit 14, the handling executingunit 15 receives information concerning this input and carries outprocessing for coping with the system failure on the server included inthe service-for-customers execution system 4 according to the content ofthe information concerning the input.

As a result, abnormality of the performance information on the serverincluded in the service-for-customers execution system 4 can be detectedcorrectly and handled in a appropriate manner.

Next, each component of the system operations management apparatus 101will be explained in detail.

The performance information collection unit 11 accesses the server ofthe service-for-customers execution system 4 periodically and acquiresperformance information thereof. The acquired performance information isstored in the performance information accumulation unit 12. In theexemplary embodiment of the present invention, the performanceinformation collection unit 11 acquires the performance informationperiodically and stores it in the performance information accumulationunit 12 sequentially.

Next, the performance information accumulation unit 12 stores theperformance information acquired by the performance informationcollection unit 11. As mentioned above, the performance information isstored in the performance information accumulation unit 12 periodicallyand sequentially.

Next, the correlation model generation unit 16 receives the performanceinformation stored in the performance information accumulation unit 12corresponding to an acquisition period set in advance, selects any twotypes of such performance information, and derives a transform function(hereinafter, a correlation function) for converting from time series ofa performance value of one type into time series of a performance valueof the other type.

The correlation model generation unit 16 derives the correlationfunctions mentioned above for all combinations of the types, and as aresult, generates a correlation model by combining each of the obtainedcorrelation functions.

Moreover, after generating the correlation model mentioned above, thecorrelation model generation unit 16 stores this correlation model inthe analytical model accumulation unit 17.

The analytical model accumulation unit 17 stores the correlation modelreceived from the correlation model generation unit 16.

Next, the correlation change analysis unit 18 substitutes a performancevalue of one type into the aforementioned correlation function so thatobtains a theoretical value (calculated value) of the performance valueof the other type, and compares an actual value (actual measurementvalue) of the performance value therewith, for performance informationacquired newly for analyses by the performance information collectionunit 11. Then, by determining whether the difference between the bothvalues is within a reference range set in advance, analysis of whetherthe correlation between the performance values of the two types ismaintained or not (hereinafter, correlation change analysis) isperformed.

The correlation change analysis unit 18 determines that the correlationbetween the performance values of the two types is maintained normallywhen the above-mentioned difference is within the reference range. Bythis analysis result, the operating status of the system, that is, theservers included in the service-for-customers execution system 4, at thetime of the acquisition of processing capacity therefrom can beconfirmed.

After that, the correlation change analysis unit 18 sends the analysisresult to the failure analysis unit 13.

Next, the failure analysis unit 13 determines whether there is apossibility of a failure on the servers included in theservice-for-customers execution system 4 based on the analysis resultreceived from the correlation change analysis unit 18 and a method setin advance, and sends the result of the determination to theadministrator dialogue unit 14.

Here, the following are examples of a technique for the above-mentioneddetermination.

In a first example, the failure analysis unit 13 confirms whether thenumber of the correlations determined as abnormal in the results of thecorrelation change analysis of the performance information exceeds avalue set in advance or not, and, when exceeding, it is determined thatthere is a possibility of a failure in the service-for-customersexecution system 4.

In a second example, only when the number of the correlations related toa specific element (a CPU utilization rate, for example) among thecorrelations determined as abnormal is grater than or equal to athreshold value set in advance, it is determined that there is apossibility of a failure in the service-for-customers execution system4.

Next, the administrator dialogue unit 14 outputs the content of thedetermination result concerning whether there is a possibility of afailure or not, received from the failure analysis unit 13, to outsidefor indication through an output unit which is not illustrated (amonitor equipped in the administrator dialogue unit 14, for example).

FIG. 25 is an explanatory drawing showing an example of contentdisplayed on the administrator dialogue unit 14 of the system operationsmanagement apparatus 101 shown in FIG. 20.

For example, the administrator dialogue unit 14 displays theabove-mentioned determination result on a display screen 14A in FIG. 25.As shown in the display screen 14A, the administrator dialogue unit 14performs displaying using charts so that a system administrator canunderstand the determination result easily.

The screen display 14A will be described further. The display screen 14Aincludes the number of correlation destruction cases 14Aa whichindicates a degree of abnormality of the performance informationanalysis result, a correlation chart 14Ab which indicates an abnormalitypoint and a list of elements with a large abnormality degree 14Ac. Thesedisplays enable the system administrator to be informed accurately thatthere is a possibility of a failure in C.CPU when the abnormality degreeof the C.CPU is large as shown in FIG. 25, for example.

After displaying the determination result of failure analysis (displayscreen 14A in FIG. 25), the administrator dialogue unit 14 receives aninput of an improvement order against the failure from the systemadministrator who has confirmed the content of the display and sendsinformation thereof to the handling executing unit 15.

Next, the handling executing unit 15 implements measures which is basedon the failure improvement order inputted to the administrator dialogueunit 14 on the servers of the service-for-customers execution system 4.

For example, when an order to reduce the amount of work is inputted fromthe administrator dialogue unit 14 in case a load of a specific CPUbecomes high, the handling executing unit 15 implements measures toreduce the work amount on the servers of the service-for-customersexecution system 4.

[Generation of Correlation Model]

Here, generation of a correlation model by the correlation modelgeneration unit 16 mentioned above will be described more specifically.

The correlation model generation unit 16 takes out, among pieces ofperformance information stored in the performance informationaccumulation unit 12, ones which have been acquired in a given periodset in advance from outside.

Next, the correlation model generation unit 16 selects any two types ofperformance information.

Here, it is supposed that the correlation model generation unit 16 hasselected “A.CPU” (the usage rate of the A.CPU) and “A.MEM” (theremaining amount of the A.MEM) among types of the performanceinformation 12B in FIG. 22, and the description will be continued.

The correlation model generation unit 16 calculates a correlationfunction F which converts time series of a performance value of “A.CPU”(input X) into time series of a performance value of “A.MEM” (output Y).

Here, according to the exemplary embodiment of the present invention,the correlation model generation unit 16 can select a suitable one fromfunctions of various forms as the content of the correlation function F.Here, it is supposed that a function of the form “Y=αX+β” has beenselected as the correlation function F, and the description will becontinued.

The correlation model generation unit 16 compares the time seriesvariation of the performance value of “A.MEM” X and the time seriesvariation of the performance value of “A.MEM” Y in the performanceinformation 12B and calculates numerical values α and β of the formula“Y=αX+β” that can convert X into Y. Here, it is supposed that “−0.6” and“100” have been calculated as α and β, respectively, as a result of thecalculation.

Moreover, the correlation model generation unit 16 compares time seriesof numerical values of Y which are obtained by converting X with theabove-mentioned correlation function “Y=−0.6X+100” and the time seriesof numerical values of actual Y and calculates weight information w ofthis correlation function from a conversion error which is a differencebetween them.

The correlation model generation unit 16 carries out the above mentionedoperation for all combinations of two types of the performanceinformation 12B. When the performance information 12B includesperformance values of five types, for example, the correlation modelgeneration unit 16 generates the correlation function F for each oftwenty combinations obtained from these five types.

Here, the correlation function F becomes a criterion to check stabilityof the service-for-customers execution system 4 that is a managementobject, therefore it is created based on the performance informationwhich has been acquired during a period when the service-for-customersexecution system 4 is stable (in normal times).

The correlation model generation unit 16 generates a correlation modelby combining various correlation functions obtained in this way intoone.

FIG. 23 is an explanatory drawing showing an example of the correlationmodel of the system operations management apparatus shown in FIG. 20.

A correlation model 17A shown in this FIG. 23 includes a plurality ofcorrelation functions corresponding to combinations of two types.

[Correlation Change Analysis]

Next, correlation change analysis by the correlation change analysisunit 18 mentioned above will be described more specifically.

Here, the description will be done on the premise that the performanceinformation collection unit 11 has acquired performance information 12Baindicated in the last line of the 12B of FIG. 22 (the performanceinformation acquired at 8:30 on Nov. 7, 2007) as the performanceinformation for the analysis.

When the performance information 12Ba is received from the performanceinformation collection unit 11, the correlation change analysis unit 18accesses the analytical model accumulation unit 17 to take out acorrelation model stored therein and extracts one correlation functionsuited for the analysis of the performance information 12Ba from thecorrelation functions included in the correlation model.

Specifically, the correlation change analysis unit 18 extracts thecorrelation functions for all combinations of the types in theperformance information 12Ba. For example, when there are three types,“A.CPU”, “A.MEM” and “B.CPU”, in the performance information 12Ba, thecorrelation change analysis unit 18 selects and extracts all correlationfunctions for the combinations “A.CPU” and “A.MEM”, “A.MEM” and “B.CPU”,and “A.CPU” and “B.CPU” regarding “X” and “Y” mentioned above.

Henceforth, the description will be continued for the case thecombination of types “A.CPU” and “A.MEM” is extracted and thecorrelation change analysis is carried out based thereon.

The correlation change analysis unit 18 substitutes the actualmeasurement of “A.CPU” for X of the above-mentioned correlation functionto calculate a numerical value of Y for the performance information12Ba. Then, the correlation change analysis unit 18 compares thenumerical value of Y that has been calculated (that is, the theoreticalvalue of “A.MEM”) and an actual numerical value of “A.MEM” of theperformance information (the actual measurement).

When it is confirmed that the difference between the theoretical valueof “A.MEM” and the actual measurement of “A.MEM” is within a referencerange set in advance as a result of the comparison, the correlationchange analysis unit 18 determines that the correlation between the twotypes “A.CPU” and “A.MEM” of the performance information 12Ba ismaintained (that is, it is normal).

On the other hand, when it is confirmed that the difference mentionedabove is out of the reference range, the correlation change analysisunit 18 determines that the correlation between the two types “A.CPU”and “A.MEM” of the performance information 12Ba is collapsed (that is,it is abnormal).

[Operations of the System Operations Management Apparatus in FIG. 20]

Next, operations of the system operations management apparatus 101 willbe described below based on FIG. 24.

FIG. 24 is a flow chart showing the operations of the system operationsmanagement apparatus shown in FIG. 20.

The performance information collection unit 11 acquires performanceinformation periodically from the service-for-customers execution unit 4(Step S101) and stores it in the performance information accumulationunit 12 (Step S102).

Next, the correlation model generation unit 16 takes out pieces ofperformance information for the period set in advance among pieces ofperformance information stored in the performance informationaccumulation unit 12, and generates a correlation model based thereon(Step S103). The correlation model generated here is stored in theanalytical model accumulation unit 17.

Next, the correlation change analysis unit 18 acquires performanceinformation which is an analysis object from the performance informationcollection unit 11 (Step S104). At the same time, the correlation changeanalysis unit 18 obtains a correlation model used for the correlationchange analysis from the analytical model accumulation unit 17.

Next, the correlation change analysis unit 18 performs the correlationchange analysis for the performance information for analyses and detectscorrelation destruction (Step S105).

After completion of the correlation change analysis, the correlationchange analysis unit 18 sends the result of the analysis to the failureanalysis unit 13.

The failure analysis unit 13 that has received the result of theanalysis confirms the number of correlations that have been determinedas being collapsed correlations (the number of the correlationdestruction cases) in the result of the analysis, and confirms whetherthe number exceeds a criterion set in advance (Step S106). When itexceeds the criterion set in advance as a result of the confirmation(Step S106/yes), the failure analysis unit 13 determines that there is apossibility of a failure in the service-for-customers execution system 4and sends information concerning the content of the detailed analysisthereof to the administrator dialogue unit 14. On the other hand, whenit does not exceed the criterion set in advance (Step S106/no), thesteps starting from Step S104 which is the step of acquisition of theperformance information for analysis are repeated.

The administrator dialogue unit 14 that has received the informationconcerning the content of the detailed analysis from the failureanalysis unit 13 indicates that there is a possibility of a failure inthe service-for-customers execution system 4 based on the information(Step S107).

Then, when an improvement order against the failure is inputted to theadministrator dialogue unit 14 by a system administrator who hasconfirmed the result of the analysis indicated on the administratordialogue unit 14, the administrator dialogue unit 14 sends informationconcerning the improvement order input to the handling executing unit 15(Step S108).

Next, when the information concerning the improvement order input isreceived, the handling executing unit 15 carries out an improvementaction on the service-for-customers execution system 4 according to thecontent thereof (Step S109).

After that, the steps starting from the step of the acquisitionoperation of the performance information for analyses (Step S104) arerepeated. By this, a change of the status of the service-for-customersexecution system 4 over time can be checked.

First Exemplary Embodiment

Next, the concrete content of a first exemplary embodiment of thepresent invention will be described based on FIGS. 1 to 6.

FIG. 1 is a block diagram showing a structure of the first exemplaryembodiment of a system operations management apparatus of the presentinvention.

Here, as shown in FIG. 1, the system operations management apparatus 1in the first exemplary embodiment of the present invention includes,like the system operations management apparatus 101 in FIG. 20 mentionedabove, a performance information collection unit 11, a performanceinformation accumulation unit 12, a correlation model generation unit16, an analytical model accumulation unit 17, a correlation changeanalysis unit 18, a failure analysis unit 13, an administrator dialogueunit 14 and a handling executing unit 15. The performance informationcollection unit 11 acquires performance information from theservice-for-customers execution system 4. The performance informationaccumulation unit 12 stores the acquired performance information. Thecorrelation model generation unit 16 generates a correlation model basedon the acquired performance information. The analytical modelaccumulation unit 17 stores the generated correlation model. Thecorrelation change analysis unit 18 analyzes abnormality of performanceinformation acquired using the correlation model. The failure analysisunit 13 determines abnormality of the service-for-customers executionsystem 4 based on the result of analysis by the correlation changeanalysis unit 18. The administrator dialogue unit 14 outputs the resultof the judgment by the failure analysis unit 13. When there is an inputof an improvement order against the content outputted by theadministrator dialogue unit 14, the handling executing unit 15 performsimprovement of the service-for-customers execution system 4 based on theorder.

Moreover, the system operations management apparatus 1 includes ananalysis schedule accumulation unit 19. The analysis scheduleaccumulation unit 19 stores schedule information which is a schedule forchanging the correlation model according to the acquisition period ofthe performance information for analyses in the correlation changeanalysis mentioned above. Here, this schedule information is created bya system administrator in advance.

The analysis schedule accumulation unit 19 is accessible from thecorrelation model generation unit 16 and the correlation change analysisunit 18. As a result, it is possible to generate a correlation model andcarry out performance information analysis based on the scheduleinformation stored in this analysis schedule accumulation unit 19.

The administrator dialogue unit 14, the correlation model generationunit 16 and the correlation change analysis unit 18 in the firstexemplary embodiment of the present invention further include newfunctions in addition to the various functions mentioned earlier.Hereinafter, those functions will be described.

The administrator dialogue unit 14 accepts an input of the scheduleinformation created in advance at the outside thereof and stores theinputted schedule information in the analysis schedule accumulation unit19.

FIG. 2, FIG. 3 and FIG. 4 are explanatory drawings showing examples ofthe schedule information in the first exemplary embodiment of thepresent invention.

For example, in schedule information 19A in FIG. 2, a schedule of thefirst priority for Saturday and Sunday of every week, and a schedule ofthe second priority for every day are designated. This scheduleinformation 19A is applied in order of the priority, and the analyticalperiod is classified into two categories, such as, every Saturday andSunday, and days of the week except them (Monday to Friday).

Similarly, in schedule information 19B in FIG. 3, only a schedule of thefirst priority for every day is designated.

In schedule information 19C in FIG. 4, a schedule of the first priorityfor the day which is the last day and a weekday of every month, aschedule of the second priority for Saturday and Sunday of every week,and a schedule of the third priority for every day are designated.

[Generation of Correlation Model]

Next, generation of a correlation model by the correlation modelgeneration unit 16 in the first exemplary embodiment of the presentinvention will be described further.

When generating a correlation model, the correlation model generationunit 16 acquires pieces of performance information for a period set inadvance from the performance information accumulation unit 12, andreceives schedule information from the analysis schedule accumulationunit 19. Then, the correlation model generation unit 16 classifiesperformance information according to an analytical period set in theschedule information referring to the time of acquisition by theperformance information collection unit 11 of the performanceinformation. After that, the correlation model generation unit 16generates a correlation model using the method mentioned above based oneach of the classified performance information groups. As a result, acorrelation model for each analytical period is obtained.

For example, a case in which the correlation model generation unit 16obtains the schedule information 19A (FIG. 2) and generates acorrelation model will be considered.

First, the correlation model generation unit 16 derives correlationfunctions based on performance information acquired by the performanceinformation collection unit 11 in the analytical period of the firstpriority, that is, Saturday and Sunday, and generates a correlationmodel based thereon.

Next, the correlation model generation unit 16 derives correlationfunctions based on performance information acquired in the analyticalperiod of the second priority, that is, Monday to Friday which is aperiod representing “every day” except the period of the above-mentionedfirst priority, and generates a correlation model based thereon.

After that, the correlation model generation unit 16 stores all of thegenerated correlation models for respective analytical periods in theanalytical model accumulation unit 17 in association with respectiveanalytical periods.

Meanwhile, in the first embodiment of the present invention, it issupposed that a model generation unit 30 includes the correlation modelgeneration unit 16. Also, it is supposed that an analysis unit 31includes the correlation change analysis unit 18 and the failureanalysis unit 13.

[Correlation Change Analysis]

Next, correlation change analysis by the correlation change analysisunit 18 in the first exemplary embodiment of the present invention willbe described further.

First, the correlation change analysis unit 18 receives performanceinformation for analysis from the information collection unit 11 andtakes out all of correlation models generated based on scheduleinformation from the analytical model accumulation unit 17. Moreover,the correlation change analysis unit 18 obtains the schedule informationfrom the analysis schedule accumulation unit 19.

Next, the correlation change analysis unit 18 confirms the time and dateof acquisition of acquired performance information. As a confirmationmethod of the time and date of acquisition on this occasion, thecorrelation change analysis unit 18 may read time and date informationincluded in the performance information (refer to the performanceinformation 12A of FIG. 21), for example.

The correlation change analysis unit 18 confirms whether a correlationmodel set at present is suited for the performing correlation changeanalysis of the performance information acquired as an object foranalysis (that is, whether the acquisition period of performanceinformation used for generation of this correlation model is the sameanalytical period as the acquisition period of the performanceinformation for analyses acquired).

As a result of the confirmation, when the correlation model is notsuited for use in correlation change analysis, the correlation changeanalysis unit 18 extracts a correlation model suitable for the analysisfrom the analytical model accumulation unit 17 and changes the settingto this correlation model.

On this occasion, when a correlation model suitable for the analysis hasnot been generated yet, the correlation change analysis unit 18 sendsinformation indicating that a correlation model suitable for theanalysis does not exist to the correlation model generation unit 16. Thecorrelation model generation unit 16 that has received this informationperforms replenishment generation of a correlation model suitable forthe analysis and stores it in the analytical model accumulation unit 17.Moreover, the correlation model generation unit 16 sends informationindicating that generation of a correlation model has been completed tothe correlation change analysis unit 18.

FIG. 5 is an explanatory drawing showing an example of an operation forgenerating a correlation change analysis result in the first exemplaryembodiment of the present invention.

As mentioned above, 18A of FIG. 5 indicates a result of analysis whendetermination of an analytical period change and an operation forexecuting analysis are carried out repeatedly. In 18Aa of FIG. 5, theanalytical period is classified into a holiday (it corresponds to theschedule of the first priority of the schedule information 19A of FIG.2) and a weekday (it corresponds to the schedule of the second priorityof the schedule information 19A of FIG. 2), and analysis is performed bygenerating a correlation model for each of the periods. A result ofanalysis as shown in 18Ab of FIG. 5 is obtained by extracting theseresults of analysis for respective analytical periods and combiningthem.

In this case, by using the correlation model for weekdays on a weekdayand the correlation model for holidays on a holiday, a result ofanalysis according to the operating characteristics of the respectiveperiods is provided. Thus, by performing analysis while switchingcorrelation models automatically according to schedule informationdesignated in advance, an analysis result with a high degree of accuracyis obtained without increasing the burden of the administrator.

The other functions in each of the units are identical with those of thesystem operations management apparatus 101 in FIG. 20 mentioned above.

[Operations of the First Exemplary Embodiment]

Next, operations of the system operations management apparatus 1 in thefirst exemplary embodiment of the present invention will be describedbelow based on FIG. 6.

FIG. 6 is a flow chart showing the operations of the system operationsmanagement apparatus in the first exemplary embodiment of the presentinvention.

Here, in order to make the flow of overall operation clear, theoperations overlapping with those of the system operations managementapparatus 101 in FIG. 20 mentioned above will be also referred to.

The administrator dialogue unit 14 sends schedule information inputtedfrom outside to the analysis schedule accumulation unit 19 and stores it(Step S201, the schedule information storing step).

The performance information collection unit 11 acquires performanceinformation periodically from a server included in theservice-for-customers execution system 4 (Step S202, the performanceinformation acquiring step), and stores it in the performanceinformation accumulation unit 12 (Step S203, the performance informationstoring step).

Next, the correlation model generation unit 16 obtains performanceinformation corresponding to a predetermined period from the performanceinformation accumulation unit 12. Moreover, the correlation modelgeneration unit 16 obtains analysis schedule information from theanalysis schedule accumulation unit 19.

Next, the correlation model generation unit 16 generates a correlationmodel for each analytical period which is included in the acquiredanalysis schedule information (Step S204, the correlation modelgeneration step) and stores it in the analytical model accumulation unit17 in association with each analytical period.

Then, the correlation change analysis unit 18 acquires performanceinformation for analysis from the performance information collectionunit 11 (Step S205, the performance information for analysis acquiringstep). The correlation change analysis unit 18 obtains the correlationmodel for each period from the analytical model accumulation unit 17 andschedule information from the analysis schedule accumulation unit 19,respectively (Step S206, the correlation model and schedule informationobtaining step).

The correlation change analysis unit 18 confirms the time and date ofacquisition of the performance information for analysis, and confirmswhether the correlation model set at present is suited for analysis ofthe performance information or not, and determines whether change of acorrelation model is needed or not (Step S207, the analytical periodselection step).

That is, when the correlation model set at present is not suited toanalysis of the performance information, the correlation change analysisunit 18 determines to change it to a correlation model suitable for theanalysis. On the other hand, when a correlation model suitable for theanalysis has been already set, the correlation change analysis unit 18determines not to change the correlation model.

When determining to change the setting of a correlation model at StepS207 (Step S207/yes), the correlation analysis unit 18 confirms whethera correlation model for the analytical period after the change has beenalready generated or not (Step S208). When not being generated yet (StepS208/no), the correlation analysis unit 18 transmits informationindicating that a correlation model for the analytical period after thechange has not been generated to the correlation model generation unit16. The correlation model generation unit 16 that has received theinformation performs replenishment generation of a correlation model andstores it in the analytical model accumulation unit 17 (Step S209, thecorrelation model replenishment generation step), and sends informationindicating that replenishment generation of the correlation model afterthe change has been completed to the correlation change analysis unit18.

When a correlation model after the change has been already generated(Step S208/yes), the correlation change analysis unit 18 performs thecorrelation change analysis of the performance information using thecorrelation model (Step S210, the correlation change analysis step).

When determining not to change a correlation model at Step S207 (StepS207/no), the correlation change analysis unit 18 performs thecorrelation change analysis using the correlation model for theanalytical period set at present without change (Step S210, thecorrelation change analysis step).

After the end of the correlation change analysis, the correlation changeanalysis unit 18 sends the result of analysis to the failure analysisunit 13.

The failure analysis unit 13 that has received the result of analysisconfirms whether the number of correlations determined as abnormal inthe correlation change analysis result of the performance informationexceeds a value specified in advance (Step S211, the failure analysisstep). When exceeding as a result of the confirmation, (Step S211/yes),the failure analysis unit 13 sends information on a detailed content ofabnormality in the performance information to the administrator dialogueunit 14. On the other hand, when not exceeding (Step S211/no), the stepsstarting from Step S205 which is the performance information foranalysis acquiring step are repeated.

When information concerning the detailed content of the abnormality ofthe performance information is received from the failure analysis unit13, the administrator dialogue unit 14 indicates that there is apossibility of a failure in the service-for-customers execution system203 based on the information (Step S212, the failure information outputstep).

Next, when an improvement order against the above-mentioned failure ofthe system is inputted to the administrator dialogue unit 14 by a systemadministrator who has confirmed the result of analysis indicated on theadministrator dialogue unit 14, the administrator dialogue unit 14 sendsinformation of the improvement order input to the handling executingunit 15 (Step S213, the improvement order information input step).

Next, upon reception of the information of the improvement order inputfrom the administrator dialogue unit 14, the handling executing unit 15carries out the improvement action on the service-for-customersexecution system 4 according to the content of the information (StepS214, the system improvement step).

After this, the steps starting from the acquisition operation ofperformance information for analyses (Step S205) are carried outrepeatedly. As a result, a change in the operation status of theservice-for-customers execution system 4 can be confirmed over time.

Here, the concrete content that are carried out in each step mentionedabove may be programmed and be executed by a computer.

Next, the characteristic structure of the first implementation of thepresent invention will be described. FIG. 26 is a block diagram showingthe characteristic structure of the first embodiment of the presentinvention.

The system operations management apparatus 1 includes the performanceinformation accumulation unit 12, the model generation unit 30 and theanalysis unit 31.

Here, the performance information accumulation unit 12 storesperformance information including a plurality of types of performancevalues in a system in time series. The model generation unit 30generates a correlation model which includes one or more correlationsbetween the different types of performance values stored in theperformance information accumulation unit 12 for each of a plurality ofperiods having one of a plurality of attributes. The analysis unit 31performs abnormality detection of the performance information of thesystem which has been inputted by using the inputted performanceinformation and the correlation model corresponding to the attribute ofa period in which the inputted performance information has beenacquired.

[The Effect of the First Exemplary Embodiment]

According to the first exemplary embodiment of the present invention,even when the environment of the service-for-customers execution system4 varies over time, correlation change analysis can be carried out uponselecting a suitable correlation model appropriately because it isarranged such that schedule information is introduced and thecorrelation change analysis is performed using a correlation model whichis based on performance information acquired in the same analyticalperiod as the time of acquisition of the performance information foranalysis. As a result, operation of the service-for-customers executionsystem 4 can be managed with a high degree of accuracy.

Moreover, according to the first exemplary embodiment of the presentinvention, generation and change of a model needed according to acombination of business patterns are automated and a burden of a systemadministrator is reduced substantially by registering the businesspatterns as schedule information in advance.

Here, the present invention is not limited to this example. In thepresent invention, the similar effect can also be obtained using othermethods which can designate change of a correlation model for ananalytical period corresponding to the time and date of acquisition ofperformance information for analyses.

In the above-mentioned description, determination whether to change acorrelation model is performed by the correlation change analysis unit18. However, in the present invention, it is not limited to thisexample. The correlation model generation unit 16 may performdetermination whether to change a correlation model, or either one ofthe correlation model generation unit 16 and the correlation changeanalysis unit 18 may perform determination and control the other. Thecorrelation model generation unit 16 and the correlation change analysisunit 18 may perform determination of an analytical period jointly.

Whichever method above is adopted, the system operations managementapparatus 1 which is able to change a correlation model according to thetime and date of acquisition of performance information for analyses andperform analysis thereof can provide the similar effect.

Second Exemplary Embodiment

Next, a second exemplary embodiment of an operations management systemaccording to the present invention will be described based on FIGS. 7 to16.

FIG. 7 is a block diagram showing a structure of the second exemplaryembodiment of a system operations management apparatus of the presentinvention.

As shown in FIG. 7, a system operations management apparatus 2 in thesecond exemplary embodiment of the present invention includes, like thesystem operations management apparatus 1 in the first exemplaryembodiment mentioned above, a performance information collection unit11, a performance information accumulation unit 12, a correlation modelgeneration unit 16, an analytical model accumulation unit 17, acorrelation change analysis unit 18, a failure analysis unit 13, anadministrator dialogue unit 14, a handling executing unit 15 and ananalysis schedule accumulation unit 19. The performance informationcollection unit 11 acquires performance information from theservice-for-customers execution system 4. The performance informationaccumulation unit 12 stores the acquired performance information. Thecorrelation model generation unit 16 generates a correlation model basedon the acquired performance information. The analytical modelaccumulation unit 17 stores the generated correlation model. Thecorrelation change analysis unit 18 analyzes abnormality of performanceinformation acquired using a correlation model. The failure analysisunit 13 determines abnormality of the service-for-customers executionsystem 4 based on the result of analysis by the correlation changeanalysis unit 18. The administrator dialogue unit 14 outputs the resultof determination by the failure analysis unit 13. When there is an inputof an improvement order against the content that the administratordialogue unit 14 has outputted, the handling executing unit 15 performsimprovement of the service-for-customers execution system 4 based on theorder. The analysis schedule accumulation unit 19 stores an analysisschedule.

Moreover, as shown in FIG. 7, this system operations managementapparatus 2 includes a periodical-model accumulation unit 20, acandidate information generation unit 21 and a correction candidategeneration unit 22. The periodical-model accumulation unit 20 storescorrelation models periodically generated by the correlation modelgeneration unit 16. The candidate information generation unit 21receives the correlation models from the periodical-model accumulationunit 20, and generates schedule candidate information which is aprovisional schedule information draft based on the varying status ofthe content of those correlation models. The correction candidategeneration unit 22 generates a correction candidate of scheduleinformation by applying calendar information which is an attribute onthe calendar to each analytical period in the schedule candidateinformation generated by the candidate information generation unit 21sequentially (by comparing each analytical period and the calendarinformation and extracting an attribute on the calendar fitting in eachanalytical period).

As shown in FIG. 7, the periodical-model accumulation unit 20 isconnected to the correlation model generation unit 16. As a result, theperiodical-model accumulation unit 20 can store correlation modelsgenerated sequentially in the correlation model generation unit 16sequentially.

FIG. 8 is a block diagram showing a structure of the candidateinformation generation unit 21 in the second exemplary embodiment of thepresent invention.

As shown in FIG. 8, the candidate information generation unit 21includes a common correlation determination unit 21 a, a static elementchange point extraction unit 21 b, a dynamic element similaritydetermination unit 21 c and a required model group extraction unit 21 d.The common correlation determination unit 21 a extracts a commoncorrelation between correlation models which have been created by thecorrelation model generation unit 16 in consecutive time segments. Thestatic element change point extraction unit 21 b extracts a time pointat which a correlation model for performance information analysis ischanged based on increase and decrease of the number of commoncorrelations extracted by the common correlation determination unit 21a. The dynamic element similarity determination unit 21 c confirms thesimilarity degree between correlations included in a correlation modelfor a new analytical period extracted by the static element change pointextraction unit 21 b and correlations included in a correlation modelused for an analytical period in the past. The required model groupextraction unit 21 d generates schedule candidate information based oneach analytical period to which a correlation model has been assigned bythe static element change point extraction unit 21 b and the dynamicelement similarity determination unit 21 c.

FIG. 11 is a block diagram showing a structure of the correctioncandidate generation unit 22 in the second exemplary embodiment of thepresent invention.

As shown in FIG. 11, the correction candidate generation unit 22includes a calendar information accumulation unit 22 a, a calendarcharacteristics determination unit 22 b and a correction candidategeneration unit 22 c. The calendar information accumulation unit 22 astores information about an attribute on the calendar (hereinafter,calendar information) such as day-of-week information and holidayinformation. The calendar characteristics determination unit 22 breceives schedule candidate information from the required model groupextraction unit 21 d in the candidate information generation unit 21 anddetermines characteristics of a date in each analytical period inschedule candidate information (hereinafter, calendar characteristics)by applying calendar information stored in the calendar informationaccumulation unit 22 a to the content of the schedule candidateinformation. The correction candidate generation unit 22 c compares thecalendar characteristics determined by the calendar characteristicsdetermination unit 22 b with the content of existing scheduleinformation, and, when there is a difference between them, generates acorrection candidate of the schedule information based on the content ofthe calendar characteristics.

Also, in the second exemplary embodiment of the present invention, thecorrelation model generation unit 16 and the administrator dialogue unit14 further include new functions in addition to the various functionsmentioned above. Hereinafter, those functions will be described.

The correlation model generation unit 16 generates correlation models ina time interval set in advance from outside. As a result, correlationmodels corresponding to various operational situations of theservice-for-customers execution system 4 can be obtained.

The administrator dialogue unit 14 acquires a correction candidate ofschedule information from the analysis schedule accumulation unit 19 anddisplays it. As a result, it is possible to show a generated scheduleinformation draft to a system administrator and to ask the systemadministrator to determine whether to change the schedule information ornot.

Meanwhile, in the second embodiment of the present invention, it issupposed that a model generation unit 30 includes the correlation modelgeneration unit 16, the candidate information generation unit 21 and thecorrection candidate generation unit 22. It is also supposed that ananalysis unit 31 includes the correlation change analysis unit 18 andthe failure analysis unit 13.

[Periodic Generation of Correlation Models]

Generation of a correlation model in the second exemplary embodiment ofthe present invention will be described centering on portions differentfrom the first exemplary embodiment mentioned above.

As mentioned above, the correlation model generation unit 16 generatescorrelation models in a time interval (in each time segment) set inadvance from outside. Here, as an example of setting of the timeinterval, a system administrator can set content indicating “generate acorrelation model at 15:00 every day” regarding a time interval.

Meanwhile, the length of each of the time interval (time segment) may bethe same or different for each time interval (time segment).

Correlation models generated sequentially are stored in theperiodical-model accumulation unit 20 sequentially, not in theanalytical model accumulation unit 17.

[Generation of Schedule Candidate Information]

Next, generation of schedule candidate information by the candidateinformation generation unit 21 mentioned above will be described below.

The common correlation determination unit 21 a takes out a plurality ofcorrelation models stored in the periodical-model accumulation unit 20.Then, among the correlation models taken out, two models generated basedon pieces of performance information in two consecutive acquisition timesegments respectively are compared and common correlations (correlationfunctions, for example) therebetween are extracted.

The common correlation determination unit 21 a performs this operationfor all combinations of correlation models generated in two consecutivetime segments.

Next, the static element change point extraction unit 21 b confirms anover-time change of the number of the common correlations based on thecommon correlations extracted by the common correlation determinationunit 21 a.

This confirmation operation of an over-time change of the number of thecommon correlations by the static element change point extraction unit21 b will be described using a specific example.

As an example, a case in which there are correlation models P, Q, R, Sand T generated for each of consecutive time segments p, q, r, s and t,respectively by the correlation model generation unit 16 based onperformance information acquired by the performance informationcollection unit 11 will be considered.

The static element change point extraction unit 21 b confirms (a) thenumber of common correlations between the correlation model P and thecorrelation model Q, (b) the number of common correlations between thecorrelation model Q and the correlation model R, (c) the number ofcommon correlations between the correlation model R and the correlationmodel S, and (d) the number of common correlations between thecorrelation model S and the correlation model T, sequentially.

It is assumed that the number of common correlations is 3 in thecombination (a), 2 in the combination (b), 3 in the combination (c), 0in the combination (d) as a result of the confirmation by the staticelement change point extraction unit 21 b.

The static element change point extraction unit 21 b determines a timepoint at which an amount of over-time change of the number of commoncorrelations between correlation models in the two consecutive timesegments mentioned above exceeds a numerical value set in advance fromoutside as a time point at which a correlation model for performanceinformation analysis should be changed (a division point of ananalytical period).

In this case, it is supposed that the setting has content indicating“change a correlation model at a time when a change in the number ofcommon correlations is equal to or more than 3.”

As a result, in the above-mentioned case, the amount of change is 1 whenmoving from the combination (a) to the combination (b), 1 when from thecombination (b) to the combination (c), and 3 when from the combination(c) to the combination (d).

Therefore, the time point when moving from the combination (c) to thecombination (d) meets the setting, and thus the static element changepoint extraction unit 21 b determines that this is a time point tochange a correlation model, that is, a division point of an analyticalperiod. Then, the static element change point extraction unit 21 bdivides the analytical period at this division point.

Next, the dynamic element similarity determination unit 21 c temporarilyassigns the latest correlation model among correlation models generatedby the correlation model generation unit 16 periodically to a newanalytical period which is set according to the division of ananalytical period mentioned above.

Moreover, the dynamic element similarity determination unit 21 cconfirms the similarity degree between the content of the correlationmodel assigned temporarily and the content of a correlation modelassigned before division of an analytical period by the static elementchange point extraction unit 21 b (a correlation model which has beenassigned to each of the analytical periods before the division point).

As a result of this confirmation, when it is confirmed that and both ofthem are similar since the similarity degree exceeds a criterion set inadvance, the dynamic element similarity determination unit 21 c changesthe correlation model in the new analytical period to the correlationmodel assigned before the division (to the correlation model similar tothe correlation model assigned temporarily among the correlation modelsassigned to the respective analytical periods before the divisionpoint).

Here, division of an analytical period and assignment of a correlationmodel for each analytical period by the static element change pointextraction unit 21 b and the dynamic element similarity determinationunit 21 c mentioned above will be described further based on FIG. 9.

FIG. 9 is an explanatory drawing showing an example of an operation forgenerating schedule candidate information in the second exemplaryembodiment of the present invention.

In 21A of this FIG. 9, division of an analytical period and assignmentof a new correlation model are indicated. In the stage 1 (21 b 1) ofFIG. 9, the period where performance information analysis has been madeby correlation model A is divided and correlation model B is set newly.In this case, when performance information analysis is being carried outwith the correlation model A, the static element change point extractionunit 21 b of the candidate information generation unit 21 finds out adifference between correlation models generated periodically, thendivides the analytical period, and assigns the correlation model B whichis the latest periodical correlation model to that period.

In the stage 2 (21 b 2) of FIG. 9, after analyses using the correlationmodel B have continued, the static element change point extraction unit21 b sets a new analytical period and assigns a correlation model Cwhich is the latest periodical correlation model, in a similar way. Atthe same time, the dynamic element similarity determination unit 21 c ofthe candidate information generation unit 21 determines the similarityof correlation model A and correlation model C. As a result, when beingdetermined that they are similar, the dynamic element similaritydetermination unit 21 c assigns the correlation model A, not thecorrelation model C, as a correlation model to the new period as shownin the stage 3 (21 c 1) of FIG. 9.

By this, a situation in which different analytical models are generatedfor analytical period respectively regardless of existing similaritybetween correlation models set for different analytical periods, andthus a large number of correlation models are generated and the memorycapacity for storage runs short can be prevented. Moreover, decrease ofthe operation speed of the system operations management apparatus 2 as awhole because of shortage of a memory for storage and a situation inwhich the operation thereof becomes unstable because of the same reasoncan be prevented.

Next, the required model group extraction unit 21 d generates schedulecandidate information by linking each analytical period to which acorrelation model has been assigned by the static element change pointextraction unit 21 b and the dynamic element similarity determinationunit 21 c together to one.

FIG. 10 is an explanatory drawing showing an example of the operationfor generating a correlation change analysis result in the secondexemplary embodiment of the present invention.

Here, 21B of FIG. 10 indicates a result of analysis of a correlationchange in the second exemplary embodiment of the present invention.

As shown in 21 c 2 of FIG. 10, the correlation model A or B is assignedto each of analytical periods 1, 2 and 3 by the static element changepoint extraction unit 21 b and the dynamic element similaritydetermination unit 21 c performing the assignment operation of acorrelation model to analytical periods mentioned above. Here, among theresults of analysis in analytical periods 1, 2 and 3, the results ofanalysis using correlation model A is referred to as A1 and A3,respectively. Similarly, the result of analysis using correlation modelB is referred to as B2.

As shown in 21 d 1 of FIG. 10, the analysis result A1, the analysisresult B2, and the analysis result A3 mentioned above are generated asthe results of analysis.

The required model group extraction unit 21 d accumulates thecorrelation models assigned to each of the analytical periods of theschedule candidate information in the analytical model accumulationmeans 20 and sends the schedule candidate information to the calendarcharacteristics determination unit 22 b of the correction candidategeneration means 22.

FIG. 12 is an explanatory drawing showing an example of the generationprocedure of a correction candidate of an analysis schedule in thesecond exemplary embodiment of the present invention.

For example, the required model group extraction unit 21 d sendsschedule candidate information 21 d 2 of FIG. 12 to the calendarcharacteristics determination unit 22 b.

[Generation of a Correction Candidate of Schedule Information]

The calendar characteristics determination unit 22 b receives schedulecandidate information from the required model group extraction unit 21 dand acquires calendar information from the calendar informationaccumulation unit 22 a. Here, the calendar information is created by asystem administrator in advance.

Then, the calendar characteristics determination unit 22 b compares thecontent of the schedule candidate information and the calendarinformation, and then applies corresponding calendar information to eachof analytical periods in the schedule candidate informationsequentially. As a result, calendar characteristics are determined.

Here, determination of calendar characteristics by the calendarcharacteristics determination unit 22 b mentioned above will bedescribed further based on FIG. 12.

As shown in FIG. 12, a case in which schedule candidate information 21 d2 for August, 2009 received from the required model group extractionunit 21 d is divided into three kinds of analytical periods A to C, thatare Saturday and Sunday, Monday to Friday, and the last day of themonth, respectively will be considered. In this case, it is supposedthat attributes on the calendar of “holiday”, “weekday” and “last day ofthe month” are set for Saturday and Sunday, Monday to Friday and Aug.31, 2009, respectively in calendar information 22 a 1.

At that time, the calendar characteristics determination unit 22 bcompares the schedule candidate information 21 d 2 and this calendarinformation 23 a 1, and extracts an attribute of the calendarinformation 23 a 1 fitting in with each analytical period of theschedule candidate information 21 d 2 (generation procedure 21 b 1). Asa result, calendar characteristics 22 b 2 is determined for therespective analytical periods in a way that the analytical periodcorresponding to Saturday and Sunday is “holiday”, the analytical periodcorresponding to Monday to Friday is “weekday” and the analytical periodcorresponding to August 31 is “last day of the month”.

By determination of the calendar characteristics, an attribute on thecalendar of each analytical period can be specified automaticallywithout investigating the content of schedule candidate information foreach analytical period point by point.

Next, the correction candidate generation unit 22 c receives thecalendar characteristics from the calendar characteristics determinationunit 22 b and receives schedule information generated by a systemadministrator in advance from the analysis schedule accumulation unit19. Then, the correction candidate generation unit 22 c compares thecontent of the calendar characteristics and the content of the scheduleinformation which has been already generated.

As a result of this comparison, when the content that is indicated bythe calendar characteristics has changed from the content of theschedule information generated in advance, the schedule informationgeneration unit 22 c generates a correction candidate of the scheduleinformation based on the content of calendar characteristics. Theschedule information generation unit 22 c stores this correctioncandidate of the schedule information in the analysis scheduleaccumulation unit 19.

FIG. 13 is an explanatory drawing showing an example of generationprocedure of a correction candidate of an analysis schedule in thesecond exemplary embodiment of the present invention (continuation ofFIG. 12).

Here, the function for generating a correction candidate of scheduleinformation by the schedule information generation unit 21 c mentionedabove will be described further based on FIG. 13.

As shown in FIG. 13, it is supposed that the calendar characteristics 22b 2 has been generated by the calendar characteristics determinationunit 22 b, and existing schedule information 19B is being stored in theanalysis schedule accumulation unit 19.

When both of them are compared, the content of calendar characteristics22 b 2 has changed from the content of existing schedule information 19Bclearly (generation procedure 22 c 1). Therefore, the scheduleinformation generation unit 22 c reflects the calendar characteristics22 b 2 in schedule information, so that generates correction candidate22 c 2 of a schedule.

As a result, even if existing schedule information is not suitable,suitable schedule information can be obtained automatically.

[Indication of a Correction Candidate of Schedule Information]

The administrator dialogue unit 14 takes out a correction candidate ofschedule information along with the schedule information generated inadvance from the analysis schedule accumulation unit 19 and displaysboth of them on an identical screen.

FIG. 14 is an explanatory drawing showing an example of contentdisplayed by the administrator dialogue unit 14 in the second exemplaryembodiment of the present invention.

For example, the administrator dialogue unit 14 displays display screen14B of FIG. 14.

As shown in this display screen 14B, the administrator dialogue unit 14displays both of the schedule information generated in advance and thecorrection candidate of the schedule information placing themside-by-side so that comparison therebetween can be performed easily.

The administrator dialogue unit 14 also displays a correlation model foreach analytical period (14Ba) and a list of required correlation models(14Bb) in the schedule information generated in advance and thecorrection candidate of the schedule information simultaneously. Thereason of this is that the differences between the schedule informationgenerated in advance and the schedule information can be made clear byclearly indicating correlation models which are constituent elements ofthem.

Moreover, the administrator dialogue unit 14 also displays operationbutton 14Bc for changing the regular schedule information from theschedule information generated in advance to the correction candidate ofthe schedule information. When a system administrator performs inputindicating that the regular schedule information is changed using thisoperation button 14Bc, information concerning this input is sent to theanalysis schedule accumulation unit 19 from the administrator dialogueunit 14, and the content of the schedule information generated inadvance is corrected based on the content of the correction candidate ofthe schedule information.

Thus a burden of a system administrator at the time of scheduleinformation generation can be reduced substantially because a systemadministrator generates schedule information of rough content in advanceand then the system operations management apparatus 2 correct thecontent to content suitable for correlation change analysis.

The other functions in each of the units are identical with those of thefirst exemplary embodiment mentioned above.

[Operations of the Second Exemplary Embodiment]

Next, the operation of the system operations management apparatus 2 inthe second exemplary embodiment of the present invention will bedescribed below based on FIG. 15 and FIG. 16 centering on portionsdifferent from the first exemplary embodiment mentioned above.

FIG. 15 is a flow chart showing the operations for generating schedulecandidate information in the second exemplary embodiment of the presentinvention.

First, like the system operations management apparatus 1 of the firstexemplary embodiment mentioned above, the performance informationcollection unit 11 acquires performance information periodically from aserver of the service-for-customers execution system 3 and stores it inthe performance information accumulation unit 12 sequentially.

Next, the correlation model generation unit 16 generates correlationmodels in a time interval set from outside in advance (FIG. 15: StepS301, the correlation model periodical generation step). After that,generated correlation models are stored in the periodical-modelaccumulation unit 20 sequentially.

Next, the common correlation determination unit 21 a of the candidateinformation generating 21 obtains correlation models corresponding totime segments set from outside in advance from the periodical-modelaccumulation unit 20. Then, the common correlation determination unit 21a compares two correlation models generated in two consecutive timesegments respectively, and extracts correlations (such as correlationfunctions) common to both of them (FIG. 15: Step S302, the commoncorrelation extracting step) among these acquired correlation models.

Next, the static element change point extraction unit 21 b confirms anover-time change of the number of common correlations mentioned above(FIG. 15: Step S303), and confirms whether the change is within areference range set from outside in advance (FIG. 15: Step S304).

At that time, when the change in the number of correlation functions iswithin the reference range (Step S304/yes), the static element changepoint extraction unit 21 b determines that performance informationshould be analyzed using the same correlation model. On the other hand,when change in the number of correlation functions exceeds the referencerange (Step S304/no), the static element change point extraction unit 21b determines this time point as a time point at which a correlationmodel for correlation change analysis is changed and divides theanalytical period at that time point (FIG. 15: Step S305, thecorrelation model division step).

Next, the dynamic element similarity determination unit 21 c assigns thelatest correlation model to a correlation model for a new analyticalperiod made by the static element change point extraction unit 21 btemporarily. After that, the content of the correlation model assignedto the analytical period before this division point and the content ofthe above-mentioned latest correlation model are compared (FIG. 15: StepS306), and the similarity degrees between them is confirmed (FIG. 15:Step S307).

At that time, when it is confirmed that they are similar since thesimilarity exceeds a reference range set in advance (Step S307/yes), thedynamic element similarity determination unit 21 c assigns thecorrelation model before the division point to the correlation model ofthis new analytical period (FIG. 15: Step S308, the correlation modelassignment step). On the other hand, when being confirmed that thesimilarity degree is equal to or lower than the reference range (StepS307/no), the dynamic element similarity determination unit 21 c assignsthe above-mentioned temporarily assigned correlation model to thecorrelation model of this new analytical period.

Next, the required model group extraction unit 21 d generates schedulecandidate information based on each analytical period to which acorrelation model has been assigned by the static element change pointextraction unit 21 b and the dynamic element similarity determinationunit 21 c, and sends it to the calendar characteristics determinationunit 22 b of the correction candidate generation unit 22 (FIG. 15: StepS309, the candidate information generation and transmission step). Also,the required model group extraction unit 21 d stores each correlationmodel assigned to each analytical period of the schedule candidateinformation in the analytical model accumulation unit 17 in associationwith each analytical period.

FIG. 16 is a flow chart showing the operations for generating acorrection candidate of schedule information in the second exemplaryembodiment of the present invention.

Next, the calendar characteristics determination unit 22 b receives theschedule candidate information from the required model group extractionunit 21 d (FIG. 16: Step S310, the candidate information obtainingstep), and obtains calendar information from the calendar informationaccumulation unit 22 a. The calendar characteristics determination unit22 b compares the content of the schedule candidate information and thecontent of the calendar information and determines calendarcharacteristics by applying the calendar information to each analyticalperiod in the schedule candidate information (FIG. 16: Step S311, thecalendar characteristics determination step).

Next, the correction candidate generation unit 22 c receives thecalendar characteristics determined by the calendar characteristicsdetermination unit 22 b, and compares the content of the calendarcharacteristics and the content of the schedule information which hasbeen already generated (FIG. 16: Step S312).

As a result of this comparison, when it is confirmed that the content ofthe calendar characteristics has changed from the content of theschedule information which has been already created (Step S313/yes), thecorrection candidate generation unit 22 c generates a correctioncandidate of the schedule information based on the calendarcharacteristics and stores it in the analysis schedule accumulation unit19 (FIG. 16: Step S314, the correction candidate generating and storingstep). Then, the administrator dialogue unit 14 obtains this correctioncandidate of the schedule information from the schedule accumulationunit 19 and shows it outside (FIG. 16: Step S315, the correctioncandidate output step). On the other hand, as a result of theabove-mentioned comparison, when it is confirmed that the content of thecalendar characteristics has not changed from the content of theexisting schedule information (Step S313/no), the correction candidategeneration unit 22 c does not generate a correction candidate of theschedule information.

When there is an input which instructs change of the scheduleinformation from outside to the administrator dialogue unit 14, theadministrator dialogue unit 14 sends information associated with theinput to the analysis schedule accumulation unit 19 and changes theregular schedule information used for correlation change analysis to thecontent of the correction candidate.

After that, the correlation change analysis unit 18 performs correlationchange analysis of performance information acquired for analyses basedon the generated schedule information.

The steps after this is the same as the first exemplary embodimentmentioned above.

Here, the concrete content that is carried out in each step mentionedabove may be programmed to be executed by a computer.

[The Effect of the Second Exemplary Embodiment]

According to the second exemplary embodiment of the present invention,even when a system administrator does not have much knowledge andexperience and thus it is difficult for the system manager to generateschedule information personally, the system administrator does not needto grasp each business pattern correctly and then generate scheduleinformation point by point, and as a result, a burden of the systemadministrator can be reduced substantially because the system operationsmanagement apparatus 2 generates the schedule information.

According to the second exemplary embodiment of the present invention,even when a business pattern is irregular and then it is difficult toregister the business pattern as schedule information, it is possible toassign a correlation model according to a change in theservice-for-customers execution system 4 automatically and accurately,and thus a highly accurate result of analysis according to actualutilization forms can always be provided because the system operationsmanagement apparatus 2 perceives the change in the environment of theservice-for-customers execution system 4 over time and generates theschedule information according thereto flexibly.

As a case in which this effect works most effectively, there is a casein which the service-for-customers execution system 4 is used commonlyby a plurality of sectors.

In this case, because there exist a plurality of users of the system,the usage pattern thereof becomes complicated. However, as mentionedabove, according to the second exemplary embodiment of the presentinvention, because generation and change of a needed correlation modelis automated, there is no decline in the accuracy of a result ofanalysis due to improper schedule setting, and thus an appropriateanalysis result is always maintained. As a result, the efficiency ofhandling against performance deterioration of a managed system isimproved.

Here, in the above-mentioned description, when a correlation model whichshould be changed is detected, the system operations managementapparatus 2 generates a correction candidate of schedule information anddisplays the existing schedule information and the correction candidateside-by-side as shown in display screen 14B (FIG. 12), and, uponreceiving an input of a correction order of the schedule informationfrom a system administrator and the like, performs correction of theschedule information. However, the present invention is not limited tothis example. For example, within a certain scope, the system operationsmanagement apparatus 2 may perform automatic correction of a schedule,or upon receiving an input from a system administrator and the like, itmay plan a future schedule change or may re-execute analysis ofperformance data in the past. That is, the similar effect is obtainedwhen a system operations management apparatus automatically generatesschedule information which a system manager had to generate point bypoint conventionally.

Third Exemplary Embodiment

Next, a third exemplary embodiment of an operations management systemaccording to the present invention will be described based on FIGS. 17to 19.

FIG. 17 is a block diagram showing a structure of the third exemplaryembodiment of a system operations management apparatus of the presentinvention.

As shown in FIG. 17, a system operations management apparatus 3 in thethird exemplary embodiment of the present invention includes aperformance information collection unit 11, a performance informationaccumulation unit 12, a correlation model generation unit 16, ananalytical model accumulation unit 17, a correlation change analysisunit 18, a failure analysis unit 13, an administrator dialogue unit 14and a handling executing unit 15 like the system operations managementapparatus 2 in the second exemplary embodiment mentioned above. Theperformance information collection unit 11 acquires performanceinformation from a service-for-customers execution system 4. Theperformance information accumulation unit 12 stores the acquiredperformance information. The correlation model generation unit 16generates a correlation model based on the acquired performanceinformation. The analytical model accumulation unit 17 stores thegenerated correlation model. The correlation change analysis unit 18analyzes abnormality of acquired performance information using thecorrelation model. The failure analysis unit 13 determines abnormalityof the service-for-customers execution system 4 based on the result ofanalysis by the correlation change analysis unit 18. The administratordialogue unit 14 outputs the result of the determination by the failureanalysis unit 13. When there is input of an improvement order againstthe content outputted by the administrator dialogue unit 14, thehandling executing unit 15 performs improvement of theservice-for-customers execution system 4 based on the order.

In addition, as shown in FIG. 17, the system operations managementapparatus 3 in the third exemplary embodiment of the present inventionincludes, like the system operations management apparatus 2 in thesecond exemplary embodiment mentioned above, an analysis scheduleaccumulation unit 19, a periodical-model accumulation unit 20, acandidate information generation unit 21 and a correction candidategeneration unit 22. The analysis schedule accumulation unit 19 stores ananalysis schedule. The periodical-model accumulation unit 20sequentially stores correlation models generated by the correlationmodel generation unit 16 periodically. The candidate informationgeneration unit 21 generates schedule candidate information which is aschedule information draft based on performance information stored inthe periodical-model accumulation unit 20. The correction candidategeneration unit 22 generates a correction candidate of scheduleinformation by applying an attribute on the calendar to the schedulecandidate information.

Moreover, as shown in FIG. 17, the system operations managementapparatus 3 includes a conforming model determination unit 23. Whenthere are a plurality of results of correlation change analysis by thecorrelation change analysis unit 18, the conforming model determinationunit 23 determines an order based on a degree of abnormality of eachanalysis result by comparing degrees of abnormality thereof.

The correlation change analysis unit 18, the failure analysis unit 13and the administrator dialogue unit 14 further include new functions inaddition to the respective functions mentioned above. Hereinafter, thosefunctions will be described.

The correlation change analysis unit 18 performs not only correlationchange analysis using the correlation model assigned according toschedule information but also correlation change analysis using theother correlation models accumulated in the analytical modelaccumulation unit 17 for performance information received from theperformance information collection unit 11.

The failure analysis unit 13 receives results of analysis using theother correlation models in addition to the result of analysis using thecorrelation model assigned according to the schedule information fromthe conforming model determination unit 23, and performs failureanalysis and sends the result thereof to the administrator dialogue unit14.

The administrator dialogue unit 14 displays the result of analysisaccording to the schedule information received from the failure analysisunit 13 and the result of analysis with another correlation modeltogether. Further, this administrator dialogue unit 14 receives an inputindicating that the result of analysis using the another correlationmodel is made be a regular result of analysis, and corrects the contentof the schedule information stored in the analysis schedule accumulationunit 19 based on the content of the another correlation model.

As a result, even if there are any defects in the content of scheduleinformation in the above-mentioned first and second exemplaryembodiment, correlation change analysis with a high degree of accuracycan be carried out by choosing a suitable correlation model from othercorrelation models and applying it to correlation change analysis.

Meanwhile, in the third embodiment of the present invention, it issupposed that the model generation unit 30 includes the correlationmodel generation unit 16, the candidate information generation unit 21,the correction candidate generation unit 22 and the conforming modeldetermination unit 23. It is also supposed that the analysis unit 31includes the correlation change analysis unit 18 and the failureanalysis unit 13.

Hereinafter, the content of the third exemplary embodiment of thepresent invention will be explained in detail centering on portionsdifferent from the first and second exemplary embodiment mentionedabove.

The correlation change analysis unit 18 obtains performance informationfor analyses from the performance information collection unit 11, andalso obtains schedule information from the analysis scheduleaccumulation unit 19 and each correlation model for an analytical periodset in advance from the analytical model accumulation unit 17.

Next, the correlation change analysis unit 18 performs correlationchange analysis of the performance information for analyses using thecorrelation model assigned according to the schedule information.Moreover, the correlation change analysis unit 18 performs correlationchange analysis using various correlation models obtained from theanalytical model accumulation unit 17.

Then, the correlation change analysis unit 18 sends all analysis resultsof the above-mentioned correlation change analyses to the conformingmodel determination unit 23.

The conforming model determination unit 23 compares degrees ofabnormality (the difference between an actual measurement value and atheoretical value) for the all results of analysis received from thecorrelation change analysis unit 18 and decides the order of eachanalysis result.

Then, the conforming model determination unit 23 confirms, in theanalysis results using the other correlation models, whether there is aanalysis result that has a degree of abnormality lower than that of theanalysis result according to the schedule information or not. When suchanalysis result exists as a result of the confirmation, the conformingmodel determination unit 23 decides that the analysis result using theother correlation model as the alternative of an analysis result anddecides the correlation model for this alternative of an analysis resultto be a conforming model. Meanwhile, when there are a plurality ofanalysis results with an abnormality degree lower than that of theanalysis result according to the schedule information, the conformingmodel determination unit 23 may decide an analysis result with thelowest degree of abnormality to be the alternative of an analysisresult.

Finally, the conforming model determination unit 23 sends both of theanalysis result according to the schedule information and thealternative of an analysis result to the failure analysis unit 13.

Here, as a method to compare the degree of abnormality of each analysisresult by the conforming model determination unit 23, there is a methodto judge from information whether a degree of abnormality is steadilylarge or steadily small, for example.

As one specific example of this, referring to 21 c 2 of FIG. 10, a casein which an analysis result A3 which is one of results of performanceinformation analysis performed using a correlation model A and ananalysis result B3 which is one of results of performance informationanalysis performed using a correlation model B are compared will beconsidered.

As a result of comparison of them, in the analysis result B3, thesituation that a degree of abnormality is higher than that of theanalysis result A3 continues for a long time (FIG. 10, 21 c 2).Therefore, in this case, the conforming model determination unit 23determines that the analysis result B3 is not a suitable analysisresult. Then, the conforming model determination unit 23 determines thatthe analysis result A3 is an analysis result more suitable than B3because the degree of abnormality of the analysis result A3 is smallerthan that of B3 steadily.

Therefore, in a case where a correlation model assigned according to theschedule information is the model B and its analysis result is B3, andthere exists the analysis result A3 obtained using the correlation modelA as an analysis result with another correlation model, the conformingmodel determination unit 22 determines that the analysis result A3 isthe alternative of an analysis result.

When the alternative is determined in the conforming model determinationunit 23, the failure analysis unit 13 receives both of the analysisresult according to the schedule information and the alternative fromthis conforming model determination unit 23, and sends both of them tothe administrator dialogue unit 14 after performing above mentionedfailure analysis of the analysis result obtained according to theschedule information.

When the analysis result according to the schedule information and thealternative have been sent from the failure analysis unit 13, theadministrator dialogue unit 14 receives the both of them and displaysboth of them simultaneously.

FIG. 18 is an explanatory drawing showing an example of contentdisplayed by the administrator dialogue unit 14 in the third exemplaryembodiment of the present invention.

For example, the administrator dialogue unit 14 displays a displayscreen 14C of FIG. 18.

This display screen 14C includes the current analysis results (analysisresults according to schedule information) 14Ca that indicates a degreeof abnormality (the difference between the actual measurement value andthe theoretical value according to a correlation function). Also, thedisplay screen 14C includes information 14Cb on analysis results in ananalytical period for which an alternative of an analysis result existsamong the current analysis results mentioned above and the correlationmodel that has been used therefor, and information 14Cc on analysisresults of the alternative of an analysis result and the correlationmodel that has been used therefor. Further, display screen 14C includesan operation button 14Cd for adopting the alternative of an analysisresult as the regular analysis result instead of the current analysisresult.

As a result, a system administrator can input an improvement orderaccording to the degree of abnormality detected in the current analysisresult (analysis result according to the schedule information) to theadministrator dialogue unit 14 based on various information displayed onthis display screen 14C.

Moreover, a system administrator can input an order indicating that thealternative of an analysis result, not the current analysis result, isadopted as the regular analysis result of performance information to theadministrator dialogue unit 14 (FIG. 18, the operation button 14Cd).

In addition, when the alternative of an analysis result is adopted as ananalysis result, the administrator dialogue unit 14 corrects the contentof the current schedule information stored in the analysis scheduleaccumulation unit 19 based on the content of the conforming model (thecorrelation model corresponding to an analytical period for which thealternative has been presented is replaced with the conforming model).As a result, accuracy of analysis result after that can be improved.

The other functions in each of the units are identical with the secondexemplary embodiment mentioned above.

[Operation of the Third Exemplary Embodiment]

Next, hereinafter, operations of the system operations managementapparatus 3 in the third exemplary embodiment of the present inventionwill be described based on FIG. 19 centering on portions different fromthe first and second exemplary embodiments mentioned above.

FIG. 19 is a flow chart showing the operations by the conforming modeldetermination unit 23 in the third exemplary embodiment of the presentinvention.

Each step for generating schedule information among the operations ofthe system operations management apparatus 3 in the third exemplaryembodiment of the present invention is the same as the second exemplaryembodiment.

In the correlation change analysis step following that, the correlationchange analysis unit 18 obtains performance information for analysesfrom the performance information collection unit 11 and also obtains allcorrelation models corresponding to a period set in advance amongaccumulated correlation models from the analytical model accumulationunit 17.

Then, the correlation change analysis unit 18 performs correlationchange analysis of the performance information using the correlationmodel assigned according to schedule information (Step S401, theoriginal model analysis step).

Next, the correlation change analysis unit 18 also performs correlationchange analysis of the performance information using the othercorrelation models acquired from the analytical model accumulation unit17 (Step S402, the other model analysis step).

Then, the correlation change analysis unit 18 sends all of an analysisresult according to the schedule information and analysis results usingthe other correlation models to the conforming model determination unit23.

Next, the conforming model determination unit 23 compares the analysisresult according to the schedule information and the analysis resultsusing the other correlation models (Step S403, the conforming modeldetermination step).

As a result, when one of the analysis results using the othercorrelation models is superior to (has a lower degree of abnormalitythan) the analysis result according to the schedule information (StepS404/yes), the conforming model determination unit 23 sets the analysisresult using the other correlation model for the alternative to theanalysis result according to the schedule information. Then, theconforming model determination unit 23 sets the other correlation modelof this alternative to the analysis result for the conforming model, andsends the analysis result according to the schedule information and thealternative to the analysis result to the failure analysis unit 13.

On the other hand, when analysis results using the other correlationmodels are not superior to the analysis result according to the scheduleinformation (Step S404/no), the conforming model determination unit 23sends only the analysis result according to the schedule information tothe failure analysis unit 13.

Next, the failure analysis unit 13 receives the analysis resultaccording to schedule information and the alternative from theconforming model determination unit 23, and, after performing failureanalysis, sends the analysis result according to the scheduleinformation of which the failure analysis has been done and thealternative to the administrator dialogue unit 14.

Next, the administrator dialogue unit 14 displays the content of theanalysis result according to the schedule information and thealternative received from the failure analysis unit 13 (Step S405, thealternative output step).

Then, the administrator dialogue unit 14 accepts an input concerning ahandling instruction by a system administrator or the like who hasbrowsed the above-mentioned displayed content, and sends information onthe input to the handling executing unit 15 (Step S406).

Moreover, when an input indicating that the alternative of the analysisresult is used as the regular schedule information is received, theadministrator dialogue unit 14 corrects the current schedule informationstored in the analysis schedule accumulation unit 19 based on thecontent of the conforming model (replaces the correlation modelcorresponding to an analytical period for which the alternative has beenpresented with the conforming model) (Step S407, the scheduleinformation correction step).

After this, the steps from Step S401 are carried out repeatedly.

Here, the concrete content that is carried out in each step mentionedabove may be programmed to be executed by a computer.

[The Effect of the Third Exemplary Embodiment]

According to the third exemplary embodiment of the present invention,even when the operation pattern of the service-for-customers executionsystem 4 changes over time (that is, a case in which theservice-for-customers execution system 4 is not necessarily operated ina manner set by schedule information), the system operations managementapparatus 3 can carry out correlation change analysis with a high degreeof accuracy. The reason is that the system operations managementapparatus 3 outputs a correlation change analysis result made by usinganother correlation model which is not assigned in the scheduleinformation, and, even if there occurs temporary disorder of theoperation pattern, a correlation change analysis result using acorrelation model corresponding to the time of the operation patterndisorder can be applied as an alternative to an analysis result.

For example, according to the third embodiment, even when business to beperformed on the last day of a month usually is moved up by any reasons,an alternative to an analysis result such as “If regarding as the lastday of the month, it is normal.” can be presented with the analysisresult according to schedule information. Thus, when there occurs asudden difference in the operation pattern of the service-for-customersexecution system 4, the system operations management apparatus 3 canshow an appropriate analysis result to a system administrator.

Moreover, according to the third exemplary embodiment of the presentinvention, the content of schedule information can always be updated tothe latest state, and thus an operations management environment in whichvarious system errors can be handled flexibly can be obtained becausethe system operations management apparatus 3 can correct the content ofschedule information stored in the analysis schedule accumulation unit19 sequentially based on the content of a conforming model.

Although the present invention has been described in eachabove-mentioned exemplary embodiment above, the present invention is notlimited to each above-mentioned exemplary embodiment.

This application is based upon and claims the benefit of priority fromJapanese Patent Application No. 2009-238747, filed on Oct. 15, 2009, thedisclosure of which is incorporated herein in its entirety by reference.

INDUSTRIAL APPLICABILITY

A system operations management apparatus, a system operations managementmethod and a program storage medium according to the present inventioncan be applied to an information processing apparatus which providesvarious information communications services such as a web service and abusiness service as mentioned above. Because performance deteriorationof a system can be detected in this information processing apparatus, itis applicable not only to an internet mail-order apparatus and aninternal information apparatus but also to various kinds of equipmentfor which a case of concentration of use by a large number of customersat a given time is assumed such as a seat reservation and issuancedevice for a railway and an airplane and automatic seat ticket purchaseequipment for movie theaters.

REFERENCE SIGNS LIST

-   -   1, 2, 3 and 101 System operations management apparatus    -   4 Service-for-customers execution system    -   11 Performance information collection unit    -   12 Performance information accumulation unit    -   13 Failure analysis unit    -   14 Administrator dialogue unit    -   15 Handling executing unit    -   16 Correlation model generation unit    -   17 Analytical model accumulation unit    -   18 Correlation change analysis unit    -   19 Analysis schedule accumulation unit    -   20 Periodical-model accumulation unit    -   21 Candidate information generation unit    -   21 a Common correlation determination unit    -   21 b Static element change point extraction unit    -   21 c Dynamic element similarity determination unit    -   21 d Required model group extraction unit    -   22 Correction candidate generation unit    -   22 a Calendar information accumulation unit    -   22 b Calendar characteristics determination unit    -   22 c Correction candidate generation unit    -   23 Conforming model determination unit    -   30 Model generation unit    -   31 Analysis unit

What is claimed is:
 1. A system operations management apparatuscomprising: hardware, including a processor; a performance informationaccumulation unit implemented at least by the hardware and which storesperformance information including a plurality of types of performancevalues in a system in time series; a model accumulation unit implementedat least by the hardware and which stores one or more correlation modelswhich includes one or more correlations between different ones of saidtypes of performance values; and a model generation unit implemented atleast by the hardware and which associates, by assigning an identicalcorrelation model to one or more periods to which said identicalcorrelation model is applied and identifying a calendar attributematching said one or more periods, said calendar attribute with saidcorrelation model.
 2. The system operations management apparatusaccording to claim 1, further comprising an analysis unit implemented atleast by the hardware and which performs abnormality detection of saidperformance information of said system which has been inputted by usingsaid inputted performance information and said correlation modelassociated with said calendar attribute of a period in which saidinputted performance information has been acquired.
 3. The systemoperations management apparatus according to claim 1, wherein the modelaccumulation unit stores said correlation model generated for each of aplurality of periods included in a predetermined period, and the modelgeneration unit set an analytical period including one or more periodshaving a common correlation, and assigns any one of said correlationmodels generated for respective periods in said analytical period tosaid analytical period.
 4. The system operations management apparatusaccording to claim 3, wherein, when a degree of increase or decrease ofa number of said correlations that are common between said correlationmodels for two consecutive periods is equal to or greater than apredetermined value, said model generation unit sets this time point fora division point to divide said predetermined period, and sets saidanalytical period including one or more periods divided by said divisionpoint.
 5. The system operations management apparatus according to claim4, wherein, when said correlation which is included in said correlationmodel set for said analytical period and said correlation which isincluded in said correlation model set for another analytical periodother than said analytical period are similar, said model generationunit assigns said correlation model set for said another analyticalperiod to said correlation model set for said analytical period.
 6. Asystem operations management method comprising: storing performanceinformation including a plurality of types of performance values in asystem in time series; storing one or more correlation models whichincludes one or more correlations between different ones of said typesof performance values; and associating, by assigning an identicalcorrelation model to one or more periods to which said identicalcorrelation model is applied and identifying a calendar attributematching said one or more periods, said calendar attribute with saidcorrelation model.
 7. The system operations management method accordingto claim 6, further comprising performing abnormality detection of saidperformance information of said system which has been inputted by usingsaid inputted performance information and said correlation modelassociated with said calendar attribute of a period in which saidinputted performance information has been acquired.
 8. The systemoperations management method according to claim 6, wherein, when storingone or more correlation models, storing said correlation model generatedfor each of a plurality of periods included in a predetermined period,and, when associating said calendar attribute with said correlationmodel, setting an analytical period including one or more periods havinga common correlation, and assigning any one of said correlation modelsgenerated for respective periods in said analytical period to saidanalytical period.
 9. The system operations management method accordingto claim 8, wherein, when associating said calendar attribute with saidcorrelation model, in a case a degree of increase or decrease of anumber of said correlations that are common between said correlationmodels for two consecutive periods is equal to or greater than apredetermined value, setting this time point for a division point todivide said predetermined period, and setting said analytical periodincluding one or more periods divided by said division point.
 10. Thesystem operations management method according to claim 9, wherein, whenassociating said calendar attribute with said correlation model, in acase said correlation which is included in said correlation model setfor said analytical period and said correlation which is included insaid correlation model set for another analytical period other than saidanalytical period are similar, assigning said correlation model set forsaid another analytical period to said correlation model set for saidanalytical period.
 11. A non-transitory computer readable mediumrecording thereon a system operations management program, causingcomputer to perform a method comprising: storing performance informationincluding a plurality of types of performance values in a system in timeseries; storing one or more correlation models which includes one ormore correlations between different ones of said types of performancevalues; and associating, by assigning an identical correlation model toone or more periods to which said identical correlation model is appliedand identifying a calendar attribute matching said one or more periods,said calendar attribute with said correlation model.
 12. Thenon-transitory computer readable medium according to claim 11, recordingthereon said system operations management program, further comprisingperforming abnormality detection of said performance information of saidsystem which has been inputted by using said inputted performanceinformation and said correlation model associated with said calendarattribute of a period in which said inputted performance information hasbeen acquired.
 13. The non-transitory computer readable medium accordingto claim 11, recording thereon said system operations managementprogram, wherein, when storing one or more correlation models, storingsaid correlation model generated for each of a plurality of periodsincluded in a predetermined period, and, when associating said calendarattribute with said correlation model, setting an analytical periodincluding one or more periods having a common correlation, and assigningany one of said correlation models generated for respective periods insaid analytical period to said analytical period.
 14. The non-transitorycomputer readable medium according to claim 13, recording thereon saidsystem operations management program, wherein, when associating saidcalendar attribute with said correlation model, in a case a degree ofincrease or decrease of a number of said correlations that are commonbetween said correlation models for two consecutive periods is equal toor greater than a predetermined value, setting this time point for adivision point to divide said predetermined period, and setting saidanalytical period including one or more periods divided by said divisionpoint.
 15. The non-transitory computer readable medium according toclaim 14, recording thereon said system operations management program,wherein, when associating said calendar attribute with said correlationmodel, in a case said correlation which is included in said correlationmodel set for said analytical period and said correlation which isincluded in said correlation model set for another analytical periodother than said analytical period are similar, assigning saidcorrelation model set for said another analytical period to saidcorrelation model set for said analytical period.
 16. A systemoperations management apparatus comprising: a performance informationaccumulation means for storing performance information including aplurality of types of performance values in a system in time series; amodel accumulation means for storing one or more correlation modelswhich includes one or more correlations between different ones of saidtypes of performance values; and a model generation means forassociating, by assigning an identical correlation model to one or moreperiods to which said identical correlation model is applied andidentifying a calendar attribute matching said one or more periods, saidcalendar attribute with said correlation model.